CVE-2025-47411

A vulnerability in the user ID creation mechanism of Apache StreamPipes (versions through 0.97.0 ) allows a user with a legitimate non-administrator account to perform a username swap with an administrator account. By manipulating JWT tokens , an attacker can gain full administrative control over...

EUVD-2026-0016

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...

Exploit for CVE-2025-67158

CVE-2025-67158 — Revotech I6032W-FHW Summary The Revotech...

PT-2026-25779

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.9 Description Authlib is a Python library used for building OAuth and OpenID Connect servers. A JWK Header Injection flaw exists in the library's JWS implementation, allowing an unauthenticated attacker to forge...

PT-2026-20985

Name of the Vulnerable Software and Affected Versions Zumba Json Serializer versions 3.2.2 and below Description The Zumba Json Serializer library allows deserialization of PHP objects from JSON using a special @type field. Prior to version 3.2.3, the deserializer instantiates any class specified...

PT-2026-25090

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.12.0 Description PyJWT is a Python implementation for handling JSON Web Tokens JWT. Before version 2.12.0, the library did not properly validate the 'crit' Critical Header Parameter as defined in RFC 7515 §4.1.11...

EUVD-2025-205842

YOURLS is vulnerable to XSS through JSONP and Callback request parameters...

GHSA-6MP4-Q625-MXJP YOURLS is vulnerable to XSS through JSONP and Callback request parameters

Summary The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLSPRIVATE is set to false public API mode, this vulnerability can be exploited by any unauthenticated attacker. In...

Malware in @peter_wilson12091/internal-json-test-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-205797

Malicious code in @peterwilson12091/internal-json-test-parser npm...

Malicious code in @peter_wilson12091/internal-json-test-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18430304f650bf998b2421e45c0b8b01fce58239d3dd6fbe9de753128aac9a4d The package @peterwilson12091/internal-json-test-parser was found to contain malicious code. Source: ghsa-malware...

[SECURITY] Fedora 43 Update: golang-github-jwt-5-5.2.1-6.fc43

A Go implementation of JSON Web Tokens...

CVE-2025-15144

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function drshowerror/drexitmsg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated...

Exploit for CVE-2025-14847

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 Detect expose...

thrift:fuzz_roundtrip_json: Crash in ___interceptor_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5302029649248256 Project: thrift Fuzzing Engine: libFuzzer Fuzz Target: fuzzroundtripjson Job Type: libfuzzerasanthrift Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c0000028c0 Crash State: interceptorpthreadcreate...

CVE-2025-15108

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

CVE-2025-15108 PandaXGO PandaX JWT Secret config.yml hard-coded key

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

CVE-2025-15108 PandaXGO PandaX JWT Secret config.yml hard-coded key

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

EUVD-2025-205477

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

EUVD-2025-205475

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key . The attack is...